#!/bin/bash . /usr/src/m2/framework/bash_functions.sh config="/etc/m2/system.conf" pcap_tshark_active=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_active/{print $2}') pcap_tshark_capture_directory=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_capture_directory/{print $2}') pcap_tshark_compress=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_compress/{print $2}') pcap_tshark_pcaps_count=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_pcaps_count/{print $2}') pcap_tshark_pcap_size=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_pcap_size/{print $2}') pcap_tshark_net_interface=$(sed 's/ //g' $config | awk -F"=" '/pcap_tshark_net_interface/{print $2}') if [[ -z $pcap_tshark_active || $pcap_tshark_active != 1 ]]; then echo -e "$(date_time) [NOTICE] pcap_tshark is not active. Exiting" exit 1 fi if ps auxf | grep -v grep | grep -Fq '/usr/sbin/tcpdump'; then echo -e "$(date_time) [NOTICE] Tcpdump is aleady running. Exiting" exit 1 fi [[ -z $pcap_tshark_capture_directory ]] && pcap_tshark_capture_directory="/var/spool/pcaps" [[ -z $pcap_tshark_compress || $pcap_tshark_compress != 1 ]] && pcap_tshark_compress=0 [[ -z $pcap_tshark_pcaps_count || ! $pcap_tshark_pcaps_count =~ ^[[:digit:]]+$ ]] && pcap_tshark_pcaps_count=100 [[ -z $pcap_tshark_pcap_size || ! $pcap_tshark_pcap_size =~ ^[[:digit:]]+$ ]] && pcap_tshark_pcap_size=20 [[ -z $pcap_tshark_net_interface ]] && pcap_tshark_net_interface="any" if [[ ! -e $pcap_tshark_capture_directory ]]; then mkdir -p "$pcap_tshark_capture_directory" fi if ! cd $pcap_tshark_capture_directory; then echo "Cannot CD to $pcap_tshark_capture_directory. Exiting" exit 1 fi echo -e "$(date_time) [NOTICE] Reshufflin old files" /usr/local/m2/m2_pcap_tshark_reshuffle_files.rb "$pcap_tshark_capture_directory" "$pcap_tshark_pcaps_count" "$pcap_tshark_compress" 2>&1 echo -e "$(date_time) [NOTICE] Running tcpdump command" if [[ $pcap_tshark_compress == 0 ]]; then echo "/usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture &" if [[ $RUN_BY_CRON == "TRUE" ]]; then /usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture & else nohup /usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture & fi else echo "/usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture -z /usr/local/m2/m2_pcap_tshark_compress_wrapper.sh &" if [[ $RUN_BY_CRON == "TRUE" ]]; then /usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture -z /usr/local/m2/m2_pcap_tshark_compress_wrapper.sh & else nohup /usr/sbin/tcpdump -i $pcap_tshark_net_interface port 5060 -s 0 -C $pcap_tshark_pcap_size -W $pcap_tshark_pcaps_count -Z root -w capture -z /usr/local/m2/m2_pcap_tshark_compress_wrapper.sh & fi fi sleep 3 if ! ps auxf | grep -v grep | grep -Fq '/usr/sbin/tcpdump'; then echo -e "$(date_time) [ERROR] Failed to start tcpdump. Check error messages above" fi